Cozmoslabs Profile_builder
22 CVEs affecting Cozmoslabs Profile_builder. Latest disclosed: 2025-05-15. Critical: 4, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6695 | Critical | 9.8 | 2024-07-31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is d… |
CVE-2023-2297 | Critical | 9.8 | 2023-04-27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and includi… |
CVE-2021-24527 | Critical | 9.8 | 2021-08-16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog… |
CVE-2024-6366 | Critical | 9.1 | 2024-07-29 | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async… |
CVE-2024-22140 | High | 8.8 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0. |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2015-9337 | High | 7.5 | 2019-08-22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. |
CVE-2024-22142 | High | 7.1 | 2024-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This… |
CVE-2024-22141 | Medium | 6.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a thr… |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2022-0653 | Medium | 6.1 | 2022-02-24 | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitizati… |
CVE-2016-10911 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. |
CVE-2015-9328 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.2.5 for WordPress has XSS. |
CVE-2014-10380 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. |
CVE-2014-8492 | Medium | 6.1 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote atta… |
CVE-2023-47669 | Medium | 5.4 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin… |
CVE-2024-6708 | Medium | 4.8 | 2025-05-15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which al… |
CVE-2022-0884 | Medium | 4.8 | 2022-04-04 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such a… |
CVE-2021-24448 | Medium | 4.8 | 2021-08-02 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' sett… |
CVE-2023-6504 | Medium | 4.3 | 2024-01-11 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of dat… |